Extracted

• • Target

    f16d27ee01a658249d7ef7785c809d29_JaffaCakes118

  • Size

    23KB

  • MD5

    f16d27ee01a658249d7ef7785c809d29

  • SHA1

    656746a12642fb533b78c43128874d155fc6849b

  • SHA256

    0cd93e398dc5e658be50cff833f362dcb0afea7c91d82ac7e9cce71adfe66b55

  • SHA512

    6e5ae3feadd19f2c8a58c485de2d9d2dc8c9539831d51ae2337310a56dd121deed1e835afb9698ba7c8922a56ce04e74cffa4e9cd9d4943db809a3477ee3f17f

  • SSDEEP

    384:t0Xn2650N38Zj+bxJeiZcsdfw6BgnewhreyRtmRvR6JZlbw8hqIusZzZXKM:+jmMy1ZXRpcnuO

  Score

  10^/10

  njrat4discoverytrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2